Merge pull request #106 from UncoderIO/gis-cortex-add-escape

saltar-ua · web-flow · commit 67aadd5c7ae2 · 2024-05-07T13:58:28.000+03:00
Add escape to the alter parsing string
diff --git a/uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py b/uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py
@@ -98,7 +98,7 @@ class CortexXQLQueryRender(PlatformQueryRender):
     mappings: CortexXSIAMMappings = cortex_xsiam_mappings
     is_strict_mapping = True
     raw_log_field_pattern = (
-        '| alter {field} = regextract(to_json_string(action_evtlog_data_fields)->{field}{{}}, ""(.*)"")'
+        '| alter {field} = regextract(to_json_string(action_evtlog_data_fields)->{field}{{}}, "\\"(.*)\\"")'
     )
 
     or_token = "or"

Original file line number	Diff line number	Diff line change
`@@ -98,7 +98,7 @@ class CortexXQLQueryRender(PlatformQueryRender):`
`98`	`98`	`mappings: CortexXSIAMMappings = cortex_xsiam_mappings`
`99`	`99`	`is_strict_mapping = True`
`100`	`100`	`raw_log_field_pattern = (`
`101`		`- '\| alter {field} = regextract(to_json_string(action_evtlog_data_fields)->{field}{{}}, ""(.*)"")'`
	`101`	`+ '\| alter {field} = regextract(to_json_string(action_evtlog_data_fields)->{field}{{}}, "\\"(.*)\\"")'`
`102`	`102`	`)`
`103`	`103`
`104`	`104`	`or_token = "or"`